first commit

platform/service/server_access.go

@@ -0,0 +1,56 @@
+package service
+
+import "browser.local/platform/domain"
+
+func (svc *CoreService) authorizeServerLifecycle(sessionID string, serverInstanceID string) error {
+	user, err := svc.GetCurrentUser(sessionID)
+	if err != nil {
+		return err
+	}
+	instance, err := svc.store.ServerInstances().Get(serverInstanceID)
+	if err != nil {
+		return err
+	}
+	if !canAccessServer(user, instance) {
+		return ErrForbidden
+	}
+	return nil
+}
+
+func (svc *CoreService) requireServerOwner(sessionID string, serverInstanceID string) (domain.User, domain.ServerInstance, error) {
+	user, err := svc.GetCurrentUser(sessionID)
+	if err != nil {
+		return domain.User{}, domain.ServerInstance{}, err
+	}
+	instance, err := svc.store.ServerInstances().Get(serverInstanceID)
+	if err != nil {
+		return domain.User{}, domain.ServerInstance{}, err
+	}
+	if instance.OwnerUserID != user.ID {
+		return domain.User{}, domain.ServerInstance{}, ErrForbidden
+	}
+	return user, instance, nil
+}
+
+func canAccessServer(user domain.User, instance domain.ServerInstance) bool {
+	return isPlatformAdmin(user) || instance.OwnerUserID == user.ID || containsString(instance.AdminUserIDs, user.ID)
+}
+
+func isPlatformAdmin(user domain.User) bool {
+	for _, role := range user.Roles {
+		switch role {
+		case "admin", "platform-admin", "platformadmin":
+			return true
+		}
+	}
+	return false
+}
+
+func containsString(values []string, target string) bool {
+	for _, value := range values {
+		if value == target {
+			return true
+		}
+	}
+	return false
+}